ProxyIdP offers a more secure way of authentication on top of passwords – the so-called Multi-Factor Authentication (MFA). Once activated, an additional form of authentication is required in addition to the required password, for example in the form of a verification code. This function makes it more difficult for potential attackers to misuse someone else’s account.
Multi-Factor Authentication as described here applies only to services that use ProxyIdP.
About ProxyIdP Multi-Factor Authentication
| Info |
|---|
Within ProxyIdP MFA, the verification code method (TOTP) must be set first. |
| Expand | ||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ||||||||||||||||||||||||||||
|
| Expand | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|
| ||||||||||
|
Verification codes (TOTP)
Before setting up Multi-Factor Authentication using authentication codes, you need to have a mobile app that generates the codes. We recommend using Aegis Authenticator for Android and Raivo OTP for iOS, also you can check the List of verified TOTP applications and password managers. You then need to add a token for the authentication codes in the ProxyIdP Multi-Factor Authentication settings and link them together.
...
Aegis Authenticator for Android | Raivo OTP for iOS |
|---|---|
 |  |
Security keys (WebAuthn)
Security keys offer maximum levels of security, it authenticates the device using so-called "asymmetric cryptography". A computer or smartphone can be used as a security key if it supports this function. When logging in, depending on the type of your device you need to either confirm a notification, use your fingerprint or facial recognition.
If you are not sure whether your device can be used a security key, you can test it here: https://webauthn.io/?regUserVerification=discouraged&attestation=none&attachment=platform&algES256=true&algRS256=true&discoverableCredential=preferred&authUserVerification=discouraged Enter any username, e.g. “test”, and click register. If the registration is successful, your device has the security key capability and can be used for ProxyIDP MFA.
| Note |
|---|
When logging into a desktop application or a mobile app (e.g. Microsoft Teams), authentication with a security key will usually not work. This is because most applications do not open a regular browser window, only something like a WebView component, and this component is not allowed to access security keys on behalf of the ProxyIdP website for security reasons. Therefore it is necessary to also register verification codes, otherwise you will not be able to log in. |
Another option is to use a key fob that can be connected to both your computer and phone - such as YubiKey, GoTrust Idem Key or SoloKey. Authentication with a key fob usually means just one extra key press.
Technical information and a support table for various operating systems is available at passkeys.dev
Which services are protected by MFA
Adding the first token automatically sets up Multi-Factor Authentication for all IT services under MUNI Unified Login. Managing for which services multi-factor authentication is enabled is possible in the User Profile.
Backup codes for restoring access
As a part of the initial set up of Multi-Factor Authentication, a set of backup codes is generated. These are used in case all registered devices are lost and access has to be restored. The codes can be saved in PDF or printed out.